From 3f3c9510be014d7da90b1b1add23654e2a2e424c Mon Sep 17 00:00:00 2001 From: OssSecurityBot Date: Mon, 3 Aug 2026 16:09:56 -0700 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yml | 11 +++++++++++ .../ci-dotnet-agentframework-sampleagent.yml | 4 ++-- .../ci-dotnet-semantickernel-sampleagent.yml | 4 ++-- .github/workflows/ci-nodejs-claude-sampleagent.yml | 4 ++-- .github/workflows/ci-nodejs-langchain-sampleagent.yml | 4 ++-- .github/workflows/ci-nodejs-openai-sampleagent.yml | 4 ++-- .github/workflows/ci-nodejs-vercelsdk-sampleagent.yml | 4 ++-- .../ci-python-agentframework-sampleagent.yml | 4 ++-- .github/workflows/ci-python-googleadk-sampleagent.yml | 4 ++-- .github/workflows/ci-python-openai-sampleagent.yml | 4 ++-- .github/workflows/dependency-review.yml | 4 ++-- .github/workflows/e2e-dotnet-agent-framework.yml | 4 ++-- .github/workflows/e2e-dotnet-semantic-kernel.yml | 4 ++-- .github/workflows/e2e-nodejs-langchain.yml | 6 +++--- .github/workflows/e2e-nodejs-openai.yml | 6 +++--- .github/workflows/e2e-orchestrator.yml | 2 +- .github/workflows/e2e-python-agent-framework.yml | 6 +++--- .github/workflows/e2e-python-openai.yml | 6 +++--- .github/workflows/points.yml | 4 ++-- .github/workflows/python-claude-sample.yml | 4 ++-- 20 files changed, 52 insertions(+), 41 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..2c48305b --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,11 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + groups: + github-actions: + patterns: ["*"] + schedule: + interval: "weekly" + cooldown: + default-days: 7 diff --git a/.github/workflows/ci-dotnet-agentframework-sampleagent.yml b/.github/workflows/ci-dotnet-agentframework-sampleagent.yml index 871c8bd3..73f5e013 100644 --- a/.github/workflows/ci-dotnet-agentframework-sampleagent.yml +++ b/.github/workflows/ci-dotnet-agentframework-sampleagent.yml @@ -23,10 +23,10 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Setup .NET ${{ matrix.dotnet-version }} - uses: actions/setup-dotnet@v4 + uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1 with: dotnet-version: ${{ matrix.dotnet-version }} diff --git a/.github/workflows/ci-dotnet-semantickernel-sampleagent.yml b/.github/workflows/ci-dotnet-semantickernel-sampleagent.yml index 6f83e84e..ad2cc56d 100644 --- a/.github/workflows/ci-dotnet-semantickernel-sampleagent.yml +++ b/.github/workflows/ci-dotnet-semantickernel-sampleagent.yml @@ -23,10 +23,10 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Setup .NET ${{ matrix.dotnet-version }} - uses: actions/setup-dotnet@v4 + uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1 with: dotnet-version: ${{ matrix.dotnet-version }} diff --git a/.github/workflows/ci-nodejs-claude-sampleagent.yml b/.github/workflows/ci-nodejs-claude-sampleagent.yml index e9238050..405a978c 100644 --- a/.github/workflows/ci-nodejs-claude-sampleagent.yml +++ b/.github/workflows/ci-nodejs-claude-sampleagent.yml @@ -22,10 +22,10 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Set up Node.js ${{ matrix.node-version }} - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: ${{ matrix.node-version }} diff --git a/.github/workflows/ci-nodejs-langchain-sampleagent.yml b/.github/workflows/ci-nodejs-langchain-sampleagent.yml index e63a551a..1a0fe448 100644 --- a/.github/workflows/ci-nodejs-langchain-sampleagent.yml +++ b/.github/workflows/ci-nodejs-langchain-sampleagent.yml @@ -22,10 +22,10 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Set up Node.js ${{ matrix.node-version }} - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: ${{ matrix.node-version }} diff --git a/.github/workflows/ci-nodejs-openai-sampleagent.yml b/.github/workflows/ci-nodejs-openai-sampleagent.yml index 75453023..4b932a94 100644 --- a/.github/workflows/ci-nodejs-openai-sampleagent.yml +++ b/.github/workflows/ci-nodejs-openai-sampleagent.yml @@ -23,10 +23,10 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Set up Node.js ${{ matrix.node-version }} - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: ${{ matrix.node-version }} diff --git a/.github/workflows/ci-nodejs-vercelsdk-sampleagent.yml b/.github/workflows/ci-nodejs-vercelsdk-sampleagent.yml index fae77c30..7eb804fb 100644 --- a/.github/workflows/ci-nodejs-vercelsdk-sampleagent.yml +++ b/.github/workflows/ci-nodejs-vercelsdk-sampleagent.yml @@ -23,10 +23,10 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Set up Node.js ${{ matrix.node-version }} - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: ${{ matrix.node-version }} diff --git a/.github/workflows/ci-python-agentframework-sampleagent.yml b/.github/workflows/ci-python-agentframework-sampleagent.yml index 462932ec..06419cfe 100644 --- a/.github/workflows/ci-python-agentframework-sampleagent.yml +++ b/.github/workflows/ci-python-agentframework-sampleagent.yml @@ -25,10 +25,10 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: ${{ matrix.python-version }} diff --git a/.github/workflows/ci-python-googleadk-sampleagent.yml b/.github/workflows/ci-python-googleadk-sampleagent.yml index 0aeb4f71..8a18b146 100644 --- a/.github/workflows/ci-python-googleadk-sampleagent.yml +++ b/.github/workflows/ci-python-googleadk-sampleagent.yml @@ -25,10 +25,10 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: ${{ matrix.python-version }} diff --git a/.github/workflows/ci-python-openai-sampleagent.yml b/.github/workflows/ci-python-openai-sampleagent.yml index 40f4d131..b69e91f9 100644 --- a/.github/workflows/ci-python-openai-sampleagent.yml +++ b/.github/workflows/ci-python-openai-sampleagent.yml @@ -25,10 +25,10 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: ${{ matrix.python-version }} diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index ab3c5558..4f28f2f6 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -14,10 +14,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Dependency Review - uses: actions/dependency-review-action@v4 + uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0 with: fail-on-severity: high comment-summary-in-pr: always diff --git a/.github/workflows/e2e-dotnet-agent-framework.yml b/.github/workflows/e2e-dotnet-agent-framework.yml index e7413971..2141fd29 100644 --- a/.github/workflows/e2e-dotnet-agent-framework.yml +++ b/.github/workflows/e2e-dotnet-agent-framework.yml @@ -34,10 +34,10 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Setup .NET - uses: actions/setup-dotnet@v4 + uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1 with: dotnet-version: '8.0.x' diff --git a/.github/workflows/e2e-dotnet-semantic-kernel.yml b/.github/workflows/e2e-dotnet-semantic-kernel.yml index 64f2412a..69025729 100644 --- a/.github/workflows/e2e-dotnet-semantic-kernel.yml +++ b/.github/workflows/e2e-dotnet-semantic-kernel.yml @@ -34,10 +34,10 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Setup .NET - uses: actions/setup-dotnet@v4 + uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1 with: dotnet-version: '8.0.x' diff --git a/.github/workflows/e2e-nodejs-langchain.yml b/.github/workflows/e2e-nodejs-langchain.yml index 5adf0ee1..d3e39baf 100644 --- a/.github/workflows/e2e-nodejs-langchain.yml +++ b/.github/workflows/e2e-nodejs-langchain.yml @@ -34,15 +34,15 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Setup .NET SDK - uses: actions/setup-dotnet@v4 + uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1 with: dotnet-version: '8.0.x' - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: '20' diff --git a/.github/workflows/e2e-nodejs-openai.yml b/.github/workflows/e2e-nodejs-openai.yml index 9c8ca775..3e9d436e 100644 --- a/.github/workflows/e2e-nodejs-openai.yml +++ b/.github/workflows/e2e-nodejs-openai.yml @@ -34,15 +34,15 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Setup .NET SDK - uses: actions/setup-dotnet@v4 + uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1 with: dotnet-version: '8.0.x' - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: '20' diff --git a/.github/workflows/e2e-orchestrator.yml b/.github/workflows/e2e-orchestrator.yml index 769db745..0f95e3de 100644 --- a/.github/workflows/e2e-orchestrator.yml +++ b/.github/workflows/e2e-orchestrator.yml @@ -137,7 +137,7 @@ jobs: - name: Post PR Comment if: always() && github.event_name == 'pull_request' && github.event.pull_request.number - uses: actions/github-script@v7 + uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0 with: script: | const pythonOpenaiIcon = '${{ needs.python-openai.result }}' === 'success' ? '✅' : '❌'; diff --git a/.github/workflows/e2e-python-agent-framework.yml b/.github/workflows/e2e-python-agent-framework.yml index 342a550a..0d1d52b9 100644 --- a/.github/workflows/e2e-python-agent-framework.yml +++ b/.github/workflows/e2e-python-agent-framework.yml @@ -34,15 +34,15 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Setup .NET SDK - uses: actions/setup-dotnet@v4 + uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1 with: dotnet-version: '8.0.x' - name: Setup Python - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: '3.11' diff --git a/.github/workflows/e2e-python-openai.yml b/.github/workflows/e2e-python-openai.yml index 06b449c5..2dc0d826 100644 --- a/.github/workflows/e2e-python-openai.yml +++ b/.github/workflows/e2e-python-openai.yml @@ -34,15 +34,15 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Setup .NET SDK - uses: actions/setup-dotnet@v4 + uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1 with: dotnet-version: '8.0.x' - name: Setup Python - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: '3.11' diff --git a/.github/workflows/points.yml b/.github/workflows/points.yml index 0a0b63f4..fd1a4787 100644 --- a/.github/workflows/points.yml +++ b/.github/workflows/points.yml @@ -32,13 +32,13 @@ jobs: (github.event_name == 'issue_comment' && github.event.issue.pull_request) steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: token: ${{ secrets.GITHUB_TOKEN }} ref: ${{ github.event.repository.default_branch }} - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: '3.11' check-latest: true diff --git a/.github/workflows/python-claude-sample.yml b/.github/workflows/python-claude-sample.yml index 9564571c..567f690e 100644 --- a/.github/workflows/python-claude-sample.yml +++ b/.github/workflows/python-claude-sample.yml @@ -20,10 +20,10 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: '3.11'